Linux never got a licensed DVD player, and the code everyone uses instead ended up on T-shirts and in a haiku

Published Aug 28, 2026, 1:30 PM EDT I’m Adam Conway, an Irish technology fanatic with a BSc in Computer Science and I'm XDA’s Lead Technical Editor. My Bachelor’s thesis was conducted on the viability of benchmarking the non-functional elements of Android apps and smartphones such as performance, and I’ve been working in the tech industry in some way or another since 2017. In my spare time, you’ll probably find me playing Counter-Strike or VALORANT, and you can reach out to me at adam@xda-developers.com, on Twitter as @AdamConwayIE, on Instagram as AdamConwayIE, or u/AdamConwayIE on Reddit. Sign in to your XDA account Chances are high that you've watched a movie on your computer before, and if you're old enough, you may have done so woth a good old fashioned DVD. However, it didn't used to be as simple as just put a DVD in your computer and start watching, especially if you used Linux. In fact, watching a movie on your computer used to be somewhat of a legal minefield. At the center of that minefield was a Norwegian teenager, Jon Lech Johansen, who just wanted to watch DVDs on his Linux box. And the program he helped write, DeCSS, was what cracked the encryption that kept free operating systems from playing commercial films, and it set off legal fights in Norway and the United States that ran for years. In Oslo, Johansen was acquitted twice, and the code itself turned into a kind of speech that people would read aloud at conferences. The encryption was never that strong to begin with CSS is a 40-bit cipher built on two shift registers Credit: Flickr The Content Scramble System isn't sophisticated cryptography in the slightest, as it's built on two linear feedback shift registers, one 17 bits and one 25 bits, and a 40-bit key, which is 5 bytes. The key was short because it had to be; the designers chose its length partly to satisfy US export regulations on cryptography, though John Gilmore has suggested Japanese export rules were the real concern. Either way, the result was a cipher short enough that a determined effort could find the key. The system works in four modes: authentication, session key, title key, and data, each with its own inverter settings. A DVD player authenticates itself to the drive, negotiates a session key, decrypts a title key, and then uses that to decrypt the actual stream. It's a layered scheme, but every layer sits on that single 40-bit foundation. It was designed to protect the content from piracy and enforce region-based viewing restrictions. However, despite the short key, the system held for the first few years of DVD's commercial life. No one had publicly broken it, and the DVD Copy Control Assocation (DVD CCA), the main body filing complaints, was happy to keep it that way. The biggest problem for tech enthusiasts was that the only way to play a disc was with a licensed player, and licensed players cost money. And Linux, alongside every other free and open source OS, had no readily-available licensed way to watch a commercial DVD. All of that changed in the autumn of 1999, but not because someone designed a better algorithm. It changed because a group of people took the encryption apart and found that the player itself was the weakest link. The first crack came from a group called DrinkOrDie. Their program, DoD DVD Speed Ripper was a closed-source application that could rip encrypted discs, and it worked by disassembling the code of a software DVD player from a company called Xing, where the player key was more or less openly accessible. Once you've extracted the key, you've got the credential the licensed player was supposed to keep secret. The group that followed, including Johansen, came to call themselves Masters of Reverse Engineering. Johansen's contribution was the graphical user interface. Some accounts claim that the decryption algorithm came from reverse engineering that same Xing player, a step court records attribute to 'the nomad'; Johansen himself attributed the decryption code to a programmer in Germany, but whether those are the same person isn't clear. The authentication code, meanwhile, came from Derek Fawcus, who had written his own CSS implementation and had it used in DeCSS with permission. Johansen posted the release announcement to the LiViD mailing list in October 1999 after testing it on the movie The Matrix, and the source code was soon published and widely redistributed. That leak was the beginning of the legal trouble, but it didn't start with the DVD CCA. No, it was Fawcus who noticed that DeCSS included his css-auth code, which he had released under the GNU GPL, and the GPL requires that derivative works carry the license along. DeCSS hadn't. It was quickly resolved with Johansen being granted a license to use the code under non-GPL terms, which ultimately resolved the violation, but it makes one thing very clear: DeCSS was a patchwork collaboration, not one man's work. The spread of DeCSS It was small and portable Once DeCSS was out, the code spread easily thanks to how small and portable it was. Versions in C, Perl, and other languages followed within weeks, and MIT students Keith Winstein and Marc Horowitz wrote qrpff, a 472-byte Perl implementation. On top of that, there was also efdtt.c, a 434-byte C program that could descramble more than 15 megabytes a second on a Mac G4 Cube. Also, hilariously, the EFF's Seth Schoen wrote a haiku that described the algorithm correctly and completely, which was... kind of its own achievement, to be honest. Johansen himself was prosecuted in his home country of Norway after complaints by the DVD CCA and the Motion Picture Association, and the case went to the Oslo District Court on December 9, 2002. The charge was a violation of section 145 of the Norwegian Criminal Code, the provision against breaking into someone else's property, with a maximum penalty of two years in prison and heavy fines. Johansen pleaded not guilty, and the EFF assisted with his defense. The theory of the prosecution was that a DVD is protected property and DeCSS was essentially the lockpick. The defense argued that the whole point of the system was to let paying customers watch what they'd bought, and that Johansen had only built a better key; he was then acquitted on January 7, 2003. That didn't settle it, though. Økokrim, the Norwegian economic crime unit that had prosecuted the case, appealed, and on March 5 the appeals court agreed that the prosecutor's arguments and some additional evidence merited another trial. So Johansen was tried a second time, and on December 22 the Borgarting Court of Appeal acquitted him again, unanimously. Økokrim said on January 5, 2004 that it wouldn't take the case to the Supreme Court, and the DVD CCA dropped its own claim against him a couple of weeks after that. He won in the end, but he had to win the same case twice. The DVD CCA, meanwhile, had been busy on its own side of the Atlantic. It had spent years suing website operators in the United States, including an action against Andrew Bunner and 92 other named and unnamed defendants over republishing DeCSS, and even a T-shirt vendor that printed the code on its shirts. The CCA somewhat succeeded here; the California Supreme Court, DVD CCA v. Bunner, held that the preliminary injunction did not violate the First Amendment. The California Supreme Court's addressed the constitutional question of protected speech rather than finally deciding whether the DVD CCA was entitled to an injunction. On remand, the Court of Appeal ruled for Bunner, finding that the DVD CCA had failed to establish that he knew or should have known the information remained a trade secret by the time he published it. More American lawsuits Code has a First Amendment problem The American cases mostly weren't about Johansen. The DVD CCA did have a claim against him, but it dropped that on January 22, 2004 without ever getting a ruling, and what the litigation actually turned on was whether DeCSS, in its written form, could be published at all. The first major case, Universal City Studios v. Reimerdes and its Corley appeal, centered on the DMCA and its anti-circumvention provisions, which prohibit bypassing technological measures controlling access to copyrighted works. Judge Lewis A. Kaplan issued a preliminary injunction prohibiting the defendants from distributing the code, but he did not agree that executable source code fell outside the First Amendment. Kaplan treated DeCSS as speech while finding that the DMCA targeted what the code did, not what it said, which made the restriction content-neutral. The Ninth Circuit had reached the speech question in Bernstein, where a panel called source code protected expression. However, that opinion didn't remain standing precedent: the court granted rehearing en banc and withdrew it later in 1999. The Second Circuit took a narrower route in Corley, agreeing that computer code can qualify as speech, but held that its functional operation still matters. It then affirmed the injunction as the DMCA regulated DeCSS as a tool for bypassing CSS. However, there was one thing that stuck: if source code is speech, then reading it aloud is protected expression, and the code became something people recited for fun. Schoen's haiku, an accurate and complete description of the descrambling algorithm, was a great explainer, and the Perl qrpff was small enough to be a stage prop. The MPAA and the DVD CCA argued that DeCSS led to piracy, an outcome which the studios had spent years trying to prevent, whereas Linux users saw a lock on media they'd legally bought. What Linux does now The legal gray area that everyone lives in Today, Linux DVD players can instead use libdvdcss, a free and open source library for decrypting CSS-encoded DVDs distributed by VideoLAN via Git. It handles drive authentication and recovers the keys needed to decrypt CSS-protected discs without requiring a licensed DVD player. A 40-bit key can be found by brute force, so a modern machine can simply try keys until one works. Libdvdcss hasn't faced the legal challenges DeCSS did, and no Linux user appears to have been prosecuted for watching a movie with it. But the DMCA's anti-circumvention provisions could still be applied to it, even if the law has never been tested on it. There's an exemption process that runs every three years, but an exemption has never been granted for watching DVDs on Linux. One could argue that libdvdcss falls under the DMCA's exception for circumvention necessary to achieve interoperability between independently created software, but that argument hasn't been tested either. Most Linux distros approach it from a point of caution: they don't ship libdvdcss by default, as it decrypts a copyrighted work and the studios might object, so users install it themselves from external repositories. In fact, Ubuntu's own documentation states that the software cannot be legally used in all countries, though notably doesn't specify which those countries are. Meanwhile, the Arch Linux forum avoids discussing libdvdcss because it sits in a legal gray area. Caution is the only safe road to take here, as neither the Norwegian acquittal nor the Bunner litigation resolved how the DMCA would apply to an ordinary Linux user or distribution using libdvdcss. The California Supreme Court's Bunner ruling was deliberately narrow, assuming the relevant trade-secret findings for purposes of deciding the First Amendment question. So the ecosystem chose to live with the ambient uncertainty rather than fight it. If you install libdvdcss and watch a DVD on Linux today, the practical enforcement risk appears effectively zero; though the legal risk is undefined. DVD CSS's legacy It was never really about DVD playback CSS decryption is still used and still works two decades later because the underlying encryption never changed, and neither did the legal ambiguity around it. It became the default way a Linux user can watch a purchased DVD, even if studios never explicitly allowed for it to be the case. Nowadays, it seems nobody is particularly interested in setting a true precedent. After all, it could swing either way, and the result could have lasting ramifications for media that studios sell to end users. What's funny is that the legal battles were never really about the program itself, and Johansen never set out to change copyright law. The courts never settled exactly how far it went, but the legal fight was about whether a paying customer could use what they actually paid for. And the T-shirt manufacturers and the MIT students who wrote a 472-byte version were making the same point. In the end, Johansen was acquitted and the code was never stopped, even though the American studios successfully used the DMCA to stop publishers from distributing it. As legally ambiguous as it was, the technique lasted long enough for CSS decryption to become an ordinary Linux package that anyone can install, and nobody actually knows for certain where it would land legally. The encryption used for DVDs was never complex, and that's probably at least partially why Blu-ray changed over from CSS to more cryptographically secure algorithms. But a 40-bit cipher with two shift registers was never going to hold up forever, and it didn't. It held up long enough to matter, though.